Question

During an active incident, a Google SecOps SOAR playbook is triggered by a high-severity alert indicating credential misuse from a workstation. The playbook is designed to automatically isolate the source host via the EDR integration. However, the enrichment step reveals the source IP maps to a shared jump server used by dozens of administrators for legitimate remote access, and there is no maintenance window active. What is the MOST appropriate playbook design decision to handle this situation?

Accepted Answer

Insert a conditional branch that checks the asset's role/criticality from enrichment and, for shared infrastructure, routes to a manual analyst approval node before executing isolation

Answer

Remove the isolation action entirely from the playbook so no host is ever automatically contained without a human running it

Answer

Proceed with automatic isolation immediately, since credential misuse is high severity and speed of containment always outweighs operational impact

Answer

Automatically block the compromised account at the IdP and skip host isolation for all alerts to avoid any impact on shared systems